Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We host a remote access tool called Simple Help. It allows us to access our clients computers and assist them with problems. I can log into it from my remote workstation, and connect to a clients workstation via our server. Then upon a successfully UDP connection Simple Help will try to "upgrade" the connection and take the server out of the picture leaving you with a direct workstation-to-workstation UDP connection. This works fine on many networks. However one of our clients has a Sonicwall firewall and it appears to be blocking this last step, the "upgrade". It seems when Simple Help tries to upgrade the connection the Sonicwall Intrustion Prevention kicks in and stops it. I've tried disabling the IPS service but to no avail. I've tried disabling Gateway AV, IPS, and AntiSpyware services under the Security Services menu all at once but still no success. I've tried removing all these services from the LAN and WAN zones. I've also tried adding an IPS exception for different IPs, no success. And it always logs that IPS detected a probable or possible port scan.

Here's a link to a screen cap of the SW Log: https://skydrive.live.com/redir?resid=D7404A61BC894BC2!225

Any ideas how to make the Sonicwall leave this traffic alone?

Alternatively a SimpleHelp Tech suggested that maybe the sonicwall is just alerting about the IPS event and is not actually blocking it via IPS. He said looking into an option called "Enable Consistent NAT" may help - any thoughts here?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

I guess I posted a bit prematurely but maybe this will help others. The "Enable Consistent NAT" option I mentioned in my question seems to have worked. Any explanations as to exactly what this option does are welcome. But my primary issue appears to be solved.

share|improve this answer
add comment

It sounds like what was happening was the connection was going on for long enough for the SonicWall to switch the NATed ports around and effectively kill your old session. When the connection is made it comes in on port XXXX but after a certain amount of time if there is not enough traffic (keep-alives) the connection on that port will get renegeotiated to port YYYY. the SonicWall did this so it keeps routing the traffic...but your app does not so it dies. Consistent NAT resolves this by keeping the connection open and not shifting ports.

This is a big issue if you are trying to use SIP phones with a hosted PBX outside your firewall.

share|improve this answer
    
great explanation, thanks! –  skinneejoe Aug 15 '12 at 11:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.